Agentic Governance Suite, native MCP gateway integrations, advanced client authentication, and ID-JAG issuance let security teams govern internal AI agents so that every agent has an owner, least-privilege access enforced at runtime, and an audit trail
Descope, a developer-friendly customer and agentic identity platform, announced Agentic Identity Hub 3.0, which brings governance, policy enforcement, and auditing to the AI agents and MCP servers that organizations run internally. This extends Descope’s leading position as an identity layer for external-facing AI agents and MCP servers by also bringing internal AI agent governance into the fold.
Employees are adopting and building AI agents faster than security and IT can inventory them, with those agents often operating with shared, long-lived credentials. Gartner predicts that the average Fortune 500 enterprise will have over 150,000 agents in use by 2028 (up from less than 15 in 2025), but only 13% of organizations think they have the right AI governance in place. Even when governance policies exist, the speed of AI adoption leads to these policies being bypassed. A recent EY survey found 47% of organizations skipping AI governance processes for urgent deployments, despite 98% having formal policies in place.
Some specific ways in which these challenges are surfacing within organizations include:
- Agents appear with no record of who requested them, what they are for, or who owns them. Thus, there is no inventory to govern and no one accountable when something goes wrong.
- Agents authenticate with static client secrets and long-lived API keys, which leak, get hardcoded into repositories, and are rarely rotated.
- Most agents employees use were built by someone else. Claude, Cursor, and third-party MCP servers cannot be instrumented by the organization running them, which leaves no place to apply policy or capture a log.
Agentic Identity Hub 3.0 provides a host of capabilities to help organizations treat every internal AI agent as a governed identity: created through an approval process, authenticated without shared secrets, and subject to policy and logging wherever it runs.
Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight
New capabilities in Agentic Identity Hub 3.0 include:
- Agentic Governance Suite, which provides a self-service onboarding and approval workflow for AI agents. Employees request a new agent along with the resources it needs to connect to—including applications, APIs, data sources, and MCP servers—and the request goes through review before anything is provisioned. Every agent ends up with a documented purpose, an accountable owner, and least-privilege access, through a process fast enough that teams do not route around it.
- MCP gateway integrations, which put a single identity and policy enforcement layer in front of every AI agent and MCP server an organization’s employees use. Descope integrates natively with MCP gateway solutions, including agentgateway, an open source project of the Agentic AI Foundation (AAIF). Authentication, authorization, and logging then apply consistently to the agents an organization builds itself and to the ones it does not control, including clients like Claude, Cursor, and ChatGPT and third-party MCP servers from GitHub, Notion, Linear, and Slack. The result is continuous, runtime authorization for AI agents across any enterprise architecture.
- Advanced client authentication, which lets agents and workloads prove who they are with keys and certificates rather than static secrets. Descope supports:
- private_key_jwt, where the client signs a short-lived assertion with a private key that never leaves the client.
- Mutual TLS (mTLS), where client and server each present certificates and both sides are verified at the connection level.
- SPIFFE, which gives workloads a verifiable identity based on what they are rather than a stored secret.
- Workload identity federation, which lets a workload running in AWS, GCP, Azure, Kubernetes, or GitHub Actions authenticate with the identity those platforms have already issued.
- ID-JAG issuance for internal agents, which provides an SSO-like experience for internal AI agents reaching any MCP server, with any user IdP behind it. Agents authenticate once through the identity provider the organization already runs and receive the appropriate level of access to each server, with no repeat logins or consent prompts along the way. Policies are evaluated on every request rather than baked into a long-lived credential, so an agent’s reach can be narrowed or revoked centrally without reissuing credentials.
“A lot of our early traction with the Agentic Identity Hub came from customer-facing AI agents and MCP servers, since that was the most natural extension of our CIAM platform,” said Slavik Markovich, Co-Founder and CEO at Descope. “However, we kept hearing from those same customers about a different problem on the inside: employees spinning up agents faster than anyone could track them, authenticating with shared secrets, and often using tools the company never built. At the end of the day, internal or external-facing AI systems have the same critical need for delegated access to resources. Agentic Identity Hub 3.0 puts an owner, scoped access, policy controls, and audit trail behind every agent, so organizations can continue adopting AI at the pace they have been without any identity bottlenecks or blindspots.”
Agentic Identity Hub 3.0 builds on the Descope Agentic Identity Hub, which handles authentication and access control for 1000+ MCP servers and millions of monthly agentic transactions. Organizations including You.com, WisdomAI, Cequence Security, Token Security, and Daylight Security use the Agentic Identity Hub to securely adopt AI agents and MCP servers with identity controls built in. Descope, a member of the Agentic AI Foundation, was named a Leader in the 2025 Frost Radar for Non-Human Identity Solutions while being recognized as one of the first identity providers to treat AI agents as a first-class identity type.
Catch more CIO Insights: How Are CIOs Aligning Technology with Workforce Agility?
[To share your insights with us, please write to psen@itechseries.com ]
